PRIOR TO THREAT 


Plan and prepare 

Develop a Bomb Threat 
Response Plan 

Provide Bomb Threat Response 
Plan training to all personnel 


IF THREAT IS RECEIVED 


Conduct threat assessment 
Execute appropriate actions 
outlined in Bomb Threat 
Response Plan 


1. PLANNING & PREPARATION 









PLANNING CONSIDERATIONS 

* Coordinate with local law enforcement & first responders 
to ensure smooth handling of a bomb threat 

« Develop clear-cut primary and alternate levels of authority 
(referred to in this document as “Site Decision Maker(s)”) 

* Select Evacuation Teams and Search Teams 

* Develop training plan 

« Determine search procedures 

* Designate control center locations 

¢ Plan for emergency assistance (police, fire, etc.) 

* Establish primary and alternate evacuation routes and 
assembly areas 

¢ Establish evacuation signal(s) 

¢« Develop a communications plan 

¢ Determine procedures for accessing/shutting off & 
reactivating utilities 


PREPARATION CONSIDERATIONS 


¢ Control building access 

« Implement strict master key control 

* Inspect incoming parcels 

¢ Safeguard confidential material 

« Keep exits unobstructed 

¢ Ensure adequate internal/external emergency lighting 
¢ Utilize electronic surveillance 


2. EMERGENCY TOOLKIT 


Items you may want to consider including in your Emergency 
Toolkit, which will be taken to the Incident Command Post. 


BUILDING FACILITY 


*« Complete set of master keys: coded to rooms and 
corresponding with a printed key list 

¢ Blueprints and floor plans or site map of building 

* Video, photographs, or a CD depicting building interior and 
exterior 


EMERGENCY RESPONSE PLANS 


¢ Copies of the Site Crisis Response Plan, Bomb Threat Plan, 
and Crisis Management Plan 
* A\list of the following phone numbers: 
* Site Decision Maker(s) 
* Police/Fire/Emergency Medical Services (EMS) 
¢ Federal Bureau of Investigation (FBI) 
¢ Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) 
« Postal Inspector 
« Nearest hospital 
¢ Facility emergency names and phone numbers 


PERSONNEL INFORMATION 


¢ Building Emergency Response Team member contact 
information and assignments 

¢ List of personnel trained in CPR and/or first aid 

¢ Updated list, with pictures if possible, of all staff/personnel 

* Staff/visitors sign-in/out sheets that include names and dates; 
Include provision for staff/visitors transported to medical 
facilities 

¢ List of staff with special needs and description of need 

* Contact information for neighboring/contiguous buildings 


ADDITIONAL EMERGENCY ACTION RESOURCES 


« Reflective vests for building emergency response team 
members with identifying marks 

¢ Bullhorn with charged batteries 

¢ AM/FM portable radio 

« Flashlights and batteries 

* Local street and zone maps 

* Clipboards 

¢ Writing materials (legal pads, pens, pencils, markers) 

¢ Plastic red/yellow tape for cordoning off areas 


3. RECEIVING A THREAT 


PHONED THREAT 


Vv 





Remain Calm & DO NOT HANG UP 

If possible, signal other staff members to listen & notify Site 
Decision Maker(s) and authorities 

If the phone has a display, copy the number and/or letters 
on the window display 

Write down the exact wording of the threat 

Keep the caller on the line for as long as possible and use 
the Bomb Threat Checklist to gather as much information as 
you can 

Record, if possible 

Fill out the Bomb Threat Checklist immediately 

Be available for interviews with the building’s emergency 
response team and law enforcement 


ERBAL THREAT 


If the perpetrator leaves, note which direction they went 
Notify the Site Decision Maker(s) and authorities 
Write down the threat exactly as it was communicated 
Note the description of the person who made the threat: 
¢ Name (if known) * Race 
« Gender ¢  Type/color of clothing 
* Body size (height/weight) » Hair & eye color 
¢ Distinguishing features * Voice (loud, deep, 
accent, etc.) 


WRITTEN THREAT 


Handle the document as little as possible 
Notify the Site Decision Maker(s) and authorities 
Rewrite the threat exactly as is on another sheet of paper 
and note the following: 
* Date/time/location document was found 
¢ Any situations or conditions surrounding the discovery/ 
delivery 
« Full names of any personnel who saw the threat 
* Secure the original threat; DO NOT alter the item in any 
way 
«If small/removable, place in a bag or envelope 
« Iflarge/stationary, secure the location 


E-MAILED THREAT 


Leave the message open on the computer 

Notify the Site Decision Maker(s) and authorities 

Print, photograph, or copy the message and subject line, 
note the date and time 


4. THREAT ASSESSMENT 





All threats should be carefully evaluated. One must consider 
the facts and the context, and then conclude whether there is 
a possible threat. 


Low Risk 


Lacks Realism: A threat that poses a minimum risk to the victim 
and public safety. Probable motive is to cause disruption. 


« Threat is vague and indirect 


¢ Information contained within the threat is inconsistent, 
implausible, or lacks detail 


« Caller is definitely known and has called numerous times 


¢ The threat was discovered instead of delivered (e.g., a threat 
written on a wall) 


Medium Risk 


Increased Level of Realism: Threat that could be carried out, 
although it may not appear entirely realistic. 
¢ Threat is direct and feasible 


¢ Wording in the threat suggest the perpetrator has given some 
thought on how the act will be carried out 


¢ May include indications of a possible place and time 


¢ No strong indication the perpetrator has taken preparatory 
steps, although there may be some indirect reference pointing 
to that possibility 


¢ Indication the perpetrator has details regarding the availability 
of components needed to construct a bomb 


¢ Increased specificity to the threat (e.g. “I’m serious!” or “I 
really mean this!”) 


High Risk 
Specific and Realistic: Threat appears to pose an immediate 
lave M-t-1a (ol ¥tcmel-lale(-1mi com tat-M-r-1(-1 Ne) Melt -1ee 


Threat is direct, specific, and realistic; may include names 
of possible victims, specific time, and location of device 


Perpetrator provides his/her identity 


Threat suggests concrete steps have been taken toward 
carrying out the threat 


Perpetrator indicates they have practiced with a weapon or 
have had the intended victim(s) under surveillance 





5. STAFF RESPONSE 


CONSIDERATIONS FOR SITE DECISION MAKER(S) 


* Immediately contact local law enforcement if not done 

* Limit access to building 

« Review Bomb Threat Response Plan 

* Conduct Threat Assessment 

¢« Determine if search is warranted based on Threat 
Assessment 


IF SEARCH IS INITIATED 


¢ Enact Search Plan 


* Communicate situation to staff/personnel and request that 
they make a quick and complete visual scan of their personal 
workspace for anything unusual 


¢ Account for all personnel 


¢ Assemble Search and Evacuation Team(s) and update 
about bomb threat condition 


GENERAL SEARCH TEAM GUIDELINES 

* Search Teams make a quick and complete visual scan of the 
search area 

¢ Divide individual rooms/areas into search levels 

¢ Take special note of any object(s) that seem out of place 

* Check ledges, balconies, waste baskets, and false ceilings 
and floors 

¢ Check for unusual odors and listen for any unusual 
background noises 

* If anything unusual is noticed, move people away from the 
potential hazard and immediately report the location of the 
object(s) to the Site Decision Maker(s) 


NOTE: Use of radio communications is NOT 
recommended unless the area has been searched 
and cleared. 


For additional information and products on bomb threats and 
improvised explosive device (IED) search procedures, please 
visit the Office for Bombing Prevention website at: 
www.cisa.gov/what-to-do-bomb-threat 


6. SUSPICIOUS ITEM 


is anything (e.g., package, vehicle) 
that is reasonably believed to contain explosives, an IED, 
or other hazardous material that requires a bomb 
technician to further evaluate it. Potential indicators are 
threats, placement, and proximity of the item to people and 
valuable assets. Examples include unexplainable wires or 
electronics, other visible bomb-like components, unusual 
sounds, vapors, mists, or odors. Generally anything that is 
Hidden, Obviously suspicious, and not Typical (HOT) 
should be deemed suspicious. 


IF SUSPICIOUS ITEM IS FOUND 


« DO NOT touch, tamper with, or move the item 
* Immediately report item to the Site Decision Maker(s) and 
local law enforcement/first responders 
¢ Site Decision Maker(s) must: 
¢ Ensure area is secured & cleared of personnel 
« Notify Search Teams 
* Ensure emergency responders are briefed 
* Evacuation & Search Teams should remain available to 
assist and inform evacuees, media, staff, and others 


CONSIDERATIONS FOR SITE DECISION MAKER(S) CONTINUING ACTIONS AFTER EVACUATION 


Not all items are suspicious 

« An unattended item is anything (e.g., bag, package, 
vehicle) not in someone’s possession and where there are 
no obvious signs of being suspicious (see above), especially 
if no threat was received 


NOTE: The discovery of one device should not 
automatically mean the conclusion of a search; 
more devices may be present! 


The Site Decision Maker(s) must take the discovery of multiple 
suspicious items into consideration during the planning and 
execution stages of the facility’s Bomb Threat Response Plan. 


7. LOCKDOWN / EVACUATION 





CONSIDERATIONS FOR SITE DECISION MAKER(S) 


Repeat Threat Assessment: 
« Is the threat still credible? 
« Were any suspicious items located (if search was 
initiated)? 
Based on the Threat Assessment, search (if initiated), and 
the totality of circumstances, determine if additional 


IF EVACUATION IS INITIATED 


A FINAL NOTE 


BOMB THREAT 
GUIDANCE 
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measures are warranted: 
¢ Partial or full lockdown? 
¢ Partial or full evacuation? 
¢ No further action? 





Select evacuation routes and assembly areas that are not in 
the vicinity of the suspicious item; ensure these routes have 
been searched and cleared 

Notify police/fire/EMS of evacuation and request assistance 
Account for all personnel 

Evacuation Team confirms the building is empty 

Bring emergency kits and building trauma kits, if available 
Advise all evacuees to remove all personal items (e.g. 
purses, backpacks) 





Debrief emergency services and assist in coordinating further 
actions 
Take accountability and report 
Open media, medical and family areas—brief regularly 
As appropriate, determine reoccupy or dismiss action 

« Reoccupy when cleared and deemed appropriate 

+ Dismiss in consultation with site administration 

* Notify all personnel of decision and ensure accountability 
Site Decision Maker(s) should remain on-scene until the 
situation is resolved or until relieved by another administrator 


These guidelines help Site Decision Maker 
react to a bomb threat in an orderly and 
controlled manner. 





Every bomb threat requires professional judgment and should 
be handled in accordance with the facility's needs. Site 
Decision Maker(s) and administrators should periodically 
review Federal guidance and work with local first responders 
to establish a Bomb Threat Response Plan that addresses 
each risk level appropriately and is optimal for their 
building(s) and personnel. 


For more information contact the 
Office for Bombing Prevention at: OBP@cisa.dhs.gov 
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